Buggy code:
public class Blob extends Lob implements java . sql . Blob { byte [ ] binaryString_ = null ; InputStream binaryStream_ = null ; int dataOffset_ ; public Blob ( byte [ ] binaryString , Agent agent , int dataOffset ) { } public Blob ( Agent agent , InputStream binaryStream , int length ) { } public Blob ( Agent agent , InputStream binaryStream ) { } public Blob ( Agent agent , int locator ) { } public long length ( ) throws SQLException { } long getLocatorLength ( ) throws SqlException { } public byte [ ] getBytes ( long pos , int length ) throws SQLException { } private byte [ ] getBytesX ( long pos , int length ) throws SqlException { } public InputStream getBinaryStream ( ) throws SQLException { } InputStream getBinaryStreamX ( ) throws SqlException { } public long position ( byte [ ] pattern , long start ) throws SQLException { } private long positionX ( byte [ ] pattern , long start ) throws SqlException { } public long position ( java . sql . Blob pattern , long start ) throws SQLException { } private long positionX ( java . sql . Blob pattern , long start ) throws SqlException { } public int setBytes ( long pos , byte [ ] bytes ) throws SQLException { } public int setBytes ( long pos , byte [ ] bytes , int offset , int len ) throws SQLException { } public int setBytesX ( long pos , byte [ ] bytes , int offset , int len ) throws SqlException { if ( pos <= 0L ) { throw new SqlException ( agent_ . logWriter_ , new ClientMessageId ( SQLState . BLOB_BAD_POSITION ) , new Long ( pos ) ) ; } if ( pos >= ( Integer . MAX_VALUE ) ) { throw new SqlException ( agent_ . logWriter_ , new ClientMessageId ( SQLState . BLOB_POSITION_TOO_LARGE ) , new Long ( pos ) ) ; } if ( ( pos - 1 ) > ( sqlLength ( ) ) ) { throw new SqlException ( agent_ . logWriter_ , new ClientMessageId ( SQLState . BLOB_POSITION_TOO_LARGE ) , new Long ( pos ) ) ; } if ( ( offset < 0 ) || ( offset > ( bytes . length ) ) ) { throw new SqlException ( agent_ . logWriter_ , new ClientMessageId ( SQLState . BLOB_INVALID_OFFSET ) , new Integer ( offset ) ) ; } if ( len < 0 ) { throw new SqlException ( agent_ . logWriter_ , new ClientMessageId ( SQLState . BLOB_NONPOSITIVE_LENGTH ) , new Integer ( len ) ) ; } if ( len == 0 ) { return 0 ; } <START_BUG> if ( ( len + offset ) > ( bytes . length ) ) { <END_BUG> throw new SqlException ( agent_ . logWriter_ , new ClientMessageId ( SQLState . BLOB_LENGTH_TOO_LONG ) , new Integer ( len ) ) ; } final int length = Math . min ( ( ( bytes . length ) - offset ) , len ) ; if ( isLocator ( ) ) { byte [ ] ba = bytes ; if ( ( offset > 0 ) || ( length < ( bytes . length ) ) ) { ba = new byte [ length ] ; System . arraycopy ( bytes , offset , ba , 0 , length ) ; } connection_ . locatorProcedureCall ( ) . blobSetBytes ( locator_ , pos , length , ba ) ; if ( ( ( pos + length ) - 1 ) > ( sqlLength ( ) ) ) { setSqlLength ( ( ( pos + length ) - 1 ) ) ; } incrementUpdateCount ( ) ; } else { if ( ( ( ( ( binaryString_ . length ) - ( dataOffset_ ) ) - ( ( int ) ( pos ) ) ) + 1 ) < length ) { byte [ ] newbuf = new byte [ ( ( ( ( int ) ( pos ) ) + length ) + ( dataOffset_ ) ) - 1 ] ; System . arraycopy ( binaryString_ , 0 , newbuf , 0 , binaryString_ . length ) ; binaryString_ = newbuf ; } System . arraycopy ( bytes , offset , binaryString_ , ( ( ( ( int ) ( pos ) ) + ( dataOffset_ ) ) - 1 ) , length ) ; binaryStream_ = new ByteArrayInputStream ( binaryString_ ) ; setSqlLength ( ( ( binaryString_ . length ) - ( dataOffset_ ) ) ) ; } return length ; } public OutputStream setBinaryStream ( long pos ) throws SQLException { } public void truncate ( long len ) throws SQLException { } public void free ( ) throws SQLException { } public InputStream getBinaryStream ( long pos , long length ) throws SQLException { } public boolean isBinaryString ( ) { } public boolean isBinaryStream ( ) { } public byte [ ] getBinaryString ( ) { } protected long binaryStringPosition ( byte [ ] pattern , long start ) { } protected boolean isSubString ( byte [ ] pattern , int index ) { } protected void materializeStream ( ) throws SqlException { } }

Fix:
if ( len > ( ( bytes . length ) - offset ) ) {